NETWORK TRAFFIC RATE LIMITING SYSTEM AND METHOD

• US 20100287303A1
• Filed: 05/11/2009
• Published: 11/11/2010
• Est. Priority Date: 05/11/2009
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Smith, Michael R., Humphress, Sean E., Vitale, Dante
• Granted Patent: US 8,825,889 B2
• Time in Patent Office: Days
• US Class Current: 709/235
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/13 in a LAN segment, e.g. ring or bus
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

A system and method is provided for rate limiting network traffic flow of an untrusted application. A master module in a server environment manages network traffic flow restrictions. A slave module executes client applications in the server environment. A services module in the server environment executes a trusted application to validate the client application to the master module. A traffic restriction module on the master module sets network traffic restrictions when validation has not been received for the client application on the slave blade, and receives client application validations from the trusted application to unrestrict network traffic flow for the client application on the slave blade.

Claims

1. A system for rate limiting network traffic flow of an untrusted application, comprising:

a master module in a server environment configured to manage network traffic flow restrictions;

a slave module configured to execute client applications in the server environment;

a services module in the server environment operable to execute a trusted application configured to validate the client application to the master module; and

a traffic restriction module on the master module operable to set network traffic restrictions on a slave module when validation has not been received for the client application on the slave module, and to receive client application validations from the trusted application to unrestrict network traffic flow for the client application on the slave module.

2. A system in accordance with claim 1, wherein the slave module, master module, and services module are each server blades.

3. A system in accordance with claim 1, further comprising a direct access module in the server environment configured to allow unrestricted traffic flow for client applications with a license.

4. A system in accordance with claim 3, wherein the license is a Software Development Kit (SDK) license.

5. A system in accordance with claim 3, wherein the license is on the slave module and the direct access module is on the services module and comprises flash memory for validating the license.

6. A system in accordance with claim 1, wherein the trusted application is executed in a slave module located with the services module.

7. A system in accordance with claim 6, wherein the services module further comprises a subsystem with an operating system, and wherein the subsystem is on a separate partition from the slave module.

8. A system in accordance with claim 1, wherein the system comprises a network switch.

9. A system in accordance with claim 1, wherein the master module, the slave module, and the services module further comprises communication ports, and wherein the master module manages network traffic flow restrictions by managing slave module port rate limits.

10. A system in accordance with claim 1, wherein the trusted application is operable to cause the master module to enable and disable network traffic flow restrictions dynamically.

11. A system in accordance with claim 10, further comprising a proprietary network protocol configured for use by the trusted application to cause the master module to enable and disable network traffic flow restrictions for the slave module.

12. A system in accordance with claim 10, wherein the trusted application is operable to disable network traffic flow restrictions to allow a user to download the client application.

13. A system in accordance with claim 1, wherein the master module, slave module, and services module communicate via a backplane.

14. A system in accordance with claim 1, wherein network traffic flow of an untrusted application is rate limited entirely by hardware.

15. A system for rate limiting network traffic flow of untrusted applications, comprising:

a master management module on a master blade in a blade server environment configured to manage network traffic flow restrictions;

a slave blade in the blade server environment and accessible by a third-party;

a client application configured to run on the slave blade;

a trusted application configured to run on a services module in the blade server environment and to validate the client application to the master management module; and

a traffic restriction module on the master management module operable to set network traffic restrictions on the slave blade when validation has not been received for the client application on the slave blade, and to receive client application validations from the trusted application to unrestrict network traffic flow for the client application on the slave blade.

16. A method for internal application authentication, comprising:

executing a trusted application on a services module in a blade server environment having restricted network traffic flow;

running a client application on a slave blade;

authenticating the client application using the trusted application;

validating the client application to a master blade using the trusted application; and

unrestricting network traffic flow for the client application on the slave blade with the master blade in response to validation of the client application.

17. A method in accordance with claim 16, further comprising unrestricting network traffic flow for the client application on the slave blade to allow a user to download an application.

18. A method in accordance with claim 16, further comprising unrestricting network traffic flow for the client application on the slave blade when the client application uses a license.

19. A method in accordance with claim 16, wherein validating the client application to the master blade using the trusted application further comprises sending a message from the trusted application to the master blade using a proprietary network protocol.

20. A method in accordance with claim 19, further comprising reconfiguring hardware on the slave blade using the master blade to change network traffic flow restrictions.